CVE-2026-45810: Nextcloud Server authorization bypass in file comments

CVE-2026-45810 · Severity: medium · CVSS 6.8 · Published 2026-06-01

Nextcloud is a collaboration platform used for file sharing and communication. A security flaw allowed any logged-in user who had permission to view at least one file comment to potentially read all comments across the entire system, including those on files they should not have access to. This could lead to the exposure of sensitive internal discussions or private information stored in file metadata.

Technologies: Nextcloud Enterprise Server, Nextcloud Server. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45810 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45810 being exploited in the wild.
How severe is CVE-2026-45810?
Medium severity, with a CVSS score of 6.8, published 1 June 2026.
Which products and versions are affected?
Nextcloud Enterprise Server 21.0.0 to 21.0.9.19, 22.0.0 to 22.2.10.34, 23.0.0 to 23.0.12.30, 24.0.0 to 24.0.12.29, 25.0.0 to 25.0.13.24, 26.0.0 to 26.0.13.21, 27.0.0 to 27.1.11.21, 28.0.0 to 28.0.14.12, 29.0.0 to 29.0.16.9, 30.0.0 to 30.0.17.4, 31.0.0 to 31.0.11, 32.0.0 to 32.0.2; Nextcloud Server 31.0.0 to 31.0.11, 32.0.0 to 32.0.2.
Is there a fix for CVE-2026-45810?
A patch was published on 2025-12-11: Initial pull requests for fixes submitted and merged into master and stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45810 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45810?
Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639, exists in the comments component of Nextcloud Server. The vulnerability stems from a missing relational check during WebDAV PROPFIND requests for file comments. An authenticated attacker with access to at least one comment could manipulate identifiers to retrieve the content of any other comment on the server. The issue affects multiple major versions of both the community and enterprise editions. Patches have been released to ensure that comment objects are properly validated against the requesting user's permissions.

Affected products

  • Nextcloud Nextcloud Server 31.0.0 to 31.0.11, 32.0.0 to 32.0.2
  • Nextcloud Nextcloud Enterprise Server 21.0.0 to 21.0.9.19, 22.0.0 to 22.2.10.34, 23.0.0 to 23.0.12.30, 24.0.0 to 24.0.12.29, 25.0.0 to 25.0.13.24, 26.0.0 to 26.0.13.21, 27.0.0 to 27.1.11.21, 28.0.0 to 28.0.14.12, 29.0.0 to 29.0.16.9, 30.0.0 to 30.0.17.4, 31.0.0 to 31.0.11, 32.0.0 to 32.0.2

Timeline

  • 2025-12-11: patched: Initial pull requests for fixes submitted and merged into master and stable branches
  • 2026-05-15: advisory: GitHub Security Advisory published
  • 2026-06-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.